Securing Mobile App Development with Compliance Aware CI/CD Pipelines in Government

Abstract

Government mobile applications should undergo a high level of regulatory controls, security baseline and release governance that is often not readily implemented in a traditional CI/CD pipeline. The given research suggests a compliance-conscious CI/CD design that is specifically designed to address mobile apps that are deployed in government and other settings of public sectors, where traceability, controlled releases, and verifiable security are obligatory. The proposed architecture integrates secure code signing with environment specific configuration management with provisioning automation to avoid misconfiguration in development, staging and production. It has integrated constant security habits by using automated statical and dependency exploration, secret recognition, and artifact integrity assurance and generates evidence that can be ingested in investigations without reducing the speed of conveyance. A release gating layer that is based on policies implements governance rules like mandatory approvals, segregation of responsibilities and risk-based promotion policies before builds are allowed to move to channels of distribution. The framework also enforces the auditable deployment of both iOS and Android, builds provenance, signing events, scan reports, and release decisions are stored in tamper-evident logs. In the real world, it can be seen that it can lead to visible improvements: a reduction in release cycles, the number of deployment failures, and the ability to comply with compliance requirements at times of high demand on the service to the population (e.g. periods of enrollment). The framework allows government teams to scale mobile delivery at the same time by aligning DevOps automation with regulatory controls to ensure security assurance and accountability of release. The paper concludes by having useful recommendations of how the adoption can be introduced such as the suggested controls, patterns of pipelines and operational concerns that can be applied to maintain compliance in the long term